Control: EC2 network interfaces should have source/destination checking enabled

Description

This control checks whether source/destination checking is enabled for an Amazon EC2 elastic network interface (ENI) that's managed by users. The control fails if source/destination checking is disabled for the user-managed ENI. This control checks only the following types of ENIs: aws_codestar_connections_managed, branch, efa, interface, lambda, and quicksight.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.ec2_network_inteface_source_destination_check_enabled

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.ec2_network_inteface_source_destination_check_enabled --share

SQL

This control uses a named query:

select
  network_interface_id as resource,
  case
    when interface_type not in ('aws_codestar_connections_managed', 'branch', 'efa', 'interface', 'lambda', 'quicksight') then 'skip'
    when source_dest_check then 'ok'
    else 'alarm'
  end as status,
  case
    when interface_type not in ('aws_codestar_connections_managed', 'branch', 'efa', 'interface', 'lambda', 'quicksight') then title || ' is of ' || interface_type || ' network interface.'
    when source_dest_check then title || ' source destination check enabled.'
    else title || ' source destination check disabled.'
  end as reason
  
  , region, account_id
from
  aws_ec2_network_interface;

Control: EC2 network interfaces should have source/destination checking enabled

Description

Usage

SQL

Tags